USN-8895-1: Sudo vulnerability

It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with timestamps omitting the trailing timezone indicator. A local attacker could possibly use this issue to execute commands outside the intended time window by...

CVE-2026-102256

A post-authentication OS Command Injection vulnerability (CWE-78) exists in the SonicWall SMA1000 appliance . This flaw allows a remote authenticated attacker with administrator privileges to execute arbitrary OS commands under specific conditions, leading to remote code execution (RCE). The vuln...

CVE-2026-102256

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

EUVD-2026-94325

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

CVE-2026-102256

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 appliance which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A flaw was found in Vim, an open-source command-line text editor. An attacker could craft a malicious tags file that, when processed by Vim's C omni-completion feature, leads to insufficient escaping of input. This vulnerability allows for the execution of arbitrary Ex commands and, subsequently,...

CVE-2026-106059

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...

CVE-2026-106058

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

CVE-2026-106056

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106057

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106059 GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...

CVE-2026-106059

GitAhead versions through 2.7.1 on macOS are vulnerable to a command injection vulnerability (CWE-78). The root cause is the unescaped interpolation of repository filenames into the Show in Finder AppleScript . An attacker can execute arbitrary shell commands by committing a file with a path cont...

EUVD-2026-94307

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...

CVE-2026-106059 GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScript

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository filenames interpolated unescaped into the Show in Finder AppleScript. Attackers can commit a file whose path contains a double quote followed by a do...

CVE-2026-106058 GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

CVE-2026-106058

GitAhead versions up to and including 2.7.1 are vulnerable to an OS command injection in the src/git/Filter.cpp component. The flaw exists because malicious repositories can execute arbitrary commands by substituting crafted filenames into clean/smudge filter commands. Specifically, an attacker c...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106058 GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...